MOVEit Zero Day Vulnerability

Date: 19th July 2023

Issue:

Secure Code Warrior is aware of the recently disclosed MOVEit vulnerabilities, CVE-2023-34362 and CVE-2023-35036. MOVEit recently announced, “a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer’s database.”

Impact:

We have assessed our internal environment, we are not using MOVEit web transfer application. Secure Code Warrior confirms we are not impacted.

Other resources:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34362

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35036